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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 
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earned patent term adjustment. See 37 CFR 1.704(b). 

Status 
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closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
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4a) Of the above claim (s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 1-14 is/are rejected. 

7) D Claim(s) is/are objected to. 
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Application Papers 
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DETAILED ACTION 

1. This action is responsive to the amendment filed on 12/3/2002. 
This action is made Final. 

2. In the amendment, claims 2-14 have been added. Claims 1-14 is pending in the case. 
Claims 1-2, and 14 are independent claims. 

3. The rejection of claim 1 under 35 U.S.C. 103(a) as being unpatentable over Quinlan et al, 
hereinafter Quinlan (Pat. # 6,397,253 Bl, 5/28/02, filed on 10/6/98), in view of Wagner (Pat. # 
6,085,224, 7/4/00, filed on 3/1 1/97), and further in view of McGee (Pat. # 6,393,468 Bl, 
5/21/02, filed on 3/13/98) has been withdrawn as necessitated by the amendment. 

Claim Objections 

4. Appropriate corrections have been made to claim 1, therefore, its objection has been 
withdrawn. 

Claim Rejections - 35 USC § 112 

5. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

6. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 
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7. Appropriate corrections have been made to claim 1, therefore, its 35 U.S.C. 1 12 lack of 
antecedent basis rejection has been withdrawn. 

8. Claims 2, and 5-8 are rejected under 35 U.S.C. 1 12, first paragraph, as containing subject 
matter which was not described in the specification in such a way as to reasonably convey to one 
skilled in the relevant art that the inventor(s), at the time the application was filed, had 
possession of the claimed invention. Claim 2 recites "appending unique session id to any URL 
in the response page" L.5. There is insufficient information in the specification disclosure to 
support the appending of a session id to any URL. The session id is appended to all URLs not 
just any of the URLs. 

9. Claim 10 recites "setting a lifetime for the unique session id " L.2. There is insufficient 
information in the specification disclosure to support the setting of a lifetime for a session id . 
The lifetime is set for the session not for the session id . 

10. Claim 1 1 recites " dropping the information from the cookie repository when the lifetime 
expires" L.2. There is insufficient information in the specification disclosure to support the 
dropping of information from the cookie repository. 

1 1 . Claim 12 recites "determining whether the client browser has disabled cookies " L.2. 
There is insufficient information in the specification disclosure to support the client browser 
having disabled cookies. 

12. Claim 14 recites "storing that information in a repository on a proxy server" L.2-3. There 
is insufficient information in the specification disclosure to support the storage of removed 
information in a proxy server . It is unclear from reading the specification where the removed 
information is stored. 
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13. Claim 14 recites "appending and identifier to any link in the document " L.5. There is 
insufficient information in the specification disclosure to support the appending of a session id to 
any URL. The session id is appended to all URLs not just any of the URLs. 

14. Claim 1 1 recites the limitation "the lifetime" in L.2. There is insufficient antecedent 
basis for this limitation in the claim. 

15. Claims 2, and 5-8 recite the limitation "storing the information in a cookie" claim 2, L.3. 
There is insufficient antecedent basis for this limitation in the claim. There is no previous 
"information" mentioned in this claim. 

Claim Rejections - 35 USC §103 

16. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 1 02 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

17. Claims 1-9, and 12-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Quinlan et al, hereinafter Quinlan (Pat. # 6,397,253 Bl, 5/28/02, filed on 10/6/98), in view of 
Wagner (Pat. # 6,085,224, 7/4/00, filed on 3/1 1/97), further in view of Langford (Pat. # 
6,507,91 1 Bl, 1/14/03, filed on 7/22/98), and further in view of McGee (Pat. # 6,393,468 Bl, 
5/21/02, filed on 3/13/98). 
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Regarding independent claim 1, Quinlan discloses managing cookies by avoiding 
unnecessary detection of cookies, stored in web page headers and by coding session information 
into URL(s) (c.7,L.26-44). 

Moreover, Quinlan discloses creating and specifying a new session id — URL — as a result 
of a browser request (c.6, L.27-67). 

Moreover, Quinlan discloses detecting cookies in the header of the response web page 
(c.7, L.27-67). Quinlan fails to explicitly teach stripping off any cookies set by an external web 
site from the response header of the response web page, and storing the cookies in a repository. 
However, Wagner discloses the deletion of cookies from web page headers (c.3,L.l-67). 
Langford teaches the deletion of desired data, encrypting and then storing it at a repository or 
storage location (c.2,L.34-c.3,L.67). It would have been obvious to a person of ordinary skill in 
the art at the time of the invention to have stripped the cookies, and stored them in a repository, 
because Wagner teaches above, the removal of unwanted cookies without modifying the browser 
code, and Langford teaches the deletion and storage of data without user invocation (c.l,L.66- 
c.2,L.67). 

Furthermore, Quinlan discloses detecting cookies in the header of the response web page 
(c.7, L.27-67). Quinlan fails to explicitly teach appending the session id to all of the links 
embedded in the response page and sending the modified response page, with the new header. 
However, Wagner discloses the deletion of cookies from web page headers, and sending the 
modified web page to a user (c.2,L.54-c.3,L.67). McGee discloses the appending of a user's 
login name or session id to all the URLs embedded in a web pages (c.10,L. 34-67, c.l l,L.56-67). 
It would have been obvious to a person of ordinary skill in the art at the time of the invention to 
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have stripped the cookies, and appended sent the web page to the requesting user, because 
Wagner teaches above, the removal of unwanted cookies without modifying the browser code, 
and McGee discloses assure that only authorized users can access web pages (c.4,L.43-67). 

Regarding independent claim 2, Quinlan discloses creating and specifying a new unique 
session id — URL — as a result of a browser request (c.6, L.27-67). 

Moreover, Quinlan discloses detecting cookies in the header of the response web page 
(c.7, L.27-67). Quinlan fails to explicitly teach removing any cookies from a response page for 
the request and storing the information in a cookie repository. However, Wagner discloses the 
deletion of cookies from web page headers (c.3,L.l-67). Langford teaches the deletion of 
desired data, encrypting and then storing it at a repository or storage location (c.2,L.34-c.3,L.67). 
It would have been obvious to a person of ordinary skill in the art at the time of the invention to 
have stripped the cookies, and stored them in a repository, because Wagner teaches above, the 
removal of unwanted cookies without modifying the browser code, and Langford teaches the 
deletion and storage of data without user invocation (c.l,L.66-c.2,L.67). 

Furthermore, Quinlan discloses detecting cookies in the header of the response web page 
(c.7, L.27-67). Quinlan fails to explicitly teach appending the unique session id to any URL in 
the response page before sending the response page to the client browser. However, Wagner 
discloses the deletion of cookies from web page headers, and sending the modified web page to a 
user (c.2,L.54-c.3,L.67). McGee discloses the appending of a user's login name or session id to 
all the URLs embedded in a web pages (c.lO,L.34-67, c.l l,L.56-67). It would have been 
obvious to a person of ordinary skill in the art at the time of the invention to have stripped the 
cookies, and appended sent the web page to the requesting user, because Wagner teaches above, 
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the removal of unwanted cookies without modifying the browser code, and McGee discloses 
assure that only authorized users can access web pages (c.4,L.43-67). 

Regarding claim 3, which depends on claim 2, Quinlan discloses detecting cookies in the 
header of the response web page (c.7, L.27-67). Quinlan fails to explicitly teach determining 
whether the client browser can accept cookies. However, Wagner discloses determining whether 
a browser accepts cookies, and if does not deleting those cookies from the HTTP headers 
(c.2,L.54-c.3,L.67). It would have been obvious to a person of ordinary skill in the art at the 
time of the invention to have combined the teachings of Quinlan, and Wagner, because Wagner 
teaches above, the removal of unwanted cookies without modifying the browser code. 

Regarding claim 4, which depends on claim 2, Quinlan discloses detecting cookies in the 
header of the response web page (c.7, L.27-67). Quinlan fails to explicitly teach checking the 
request for an existing session id before generating a unique session id. However, Langford 
teaches the deletion of desired data, encrypting, storing it at a repository or storage location to be 
retrieved by a user at a later time (c.2,L.34-c.3,L.67). It would have been obvious to a person of 
ordinary skill in the art at the time of the invention to have stripped the cookies, and stored them 
in a repository, because Wagner teaches above, the removal of unwanted cookies without 
modifying the browser code, and Langford teaches protecting data deleted by a user (c.l,L.66- 
c.2,L.67). 

Regarding claim 5, which depends on claim 2, Quinlan discloses detecting cookies in the 
header of the response web page (c.7, L.27-67). Quinlan fails to explicitly teach encrypting the 
session id. McGee discloses checking for an existing login name or session id, in a user's 
request, before generating unique session ids to be appended to links in a web page (c.lO,L.34- 
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67, c. 1 l,L.56-67). It would have been obvious to a person of ordinary skill in the art at the time 
of the invention to have stripped the cookies, and appended sent the web page to the requesting 
user, because Wagner teaches above, the removal of unwanted cookies without modifying the 
browser code, and McGee discloses assure that only authorized users can access web pages 
(c.4 5 L.43-67). 

Regarding claim 6, which depends on claim 5, Quinlan discloses detecting cookies in the 
header of the response web page (c.7, L.27-67). Quinlan fails to explicitly teach retrieving a 
cookie from the cookie repository corresponding to the existing session id. However, Wagner 
discloses the deletion of cookies from web page headers, and sending the modified web page to a 
user (c.2,L.54-c.3,L.67). Langford teaches the deletion of desired data, encrypting, storing it at a 
repository or storage location to be retrieved by a user at a later time (c.2,L.34-c.3,L.67). It 
would have been obvious to a person of ordinary skill in the art at the time of the invention to 
have stripped the cookies, and stored them in a repository, because Wagner teaches above, the 
removal of unwanted cookies without modifying the browser code, and Langford teaches 
protecting data deleted by a user (c.l,L.66-c.2,L.67). 

Regarding claim 7, which depends on claim 6, Quinlan discloses detecting cookies in a 
generated header of the response web page (c.7, L.27-67, c.l2,L.l-67). 

Claim 8 is directed towards a method for implementing the steps found in claim 7, and 
therefore is similarly rejected. 

Regarding claim 9, which depends on claim 2, Quinlan discloses the reception of a web 
page as a result of a user's request to an external web site server (c.l 1, L.36-c.l2,L.67). 
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Regarding claim 12, which depends on claim 2, Quinlan discloses detecting cookies in 
the header of the response web page (c.7, L.27-67). Quinlan fails to explicitly teach determining 
whether the client browser has disabled cookies. However, Wagner discloses determining 
whether a user has disabled cookies' reception in a browser (c.2,L.54-c.3,L.67). It would have 
been obvious to a person of ordinary skill in the art at the time of the invention to have combined 
the teachings of Quinlan, and Wagner, because Wagner teaches above, the removal of unwanted 
cookies without modifying the browser code. 

Regarding claim 13, which depends on claim 2, Quinlan discloses detecting cookies in 
the header of the response web page (c.7, L.27-67). Quinlan fails to explicitly teach receiving the 
request from the client browser to a proxy server, the proxy server hosting the cookie repository. 
However, Wagner discloses the deletion of cookies from web page headers, and sending the 
modified web page to a user (c.2,L.54-c.3,L.67). Langford teaches the deletion of desired data, 
encrypting, storing it at a repository or remote storage location to be retrieved by a user at a later 
time (c.2,L.34-c.3,L.67). It would have been obvious to a person of ordinary skill in the art at the 
time of the invention to have stripped the cookies, and stored them in a repository, because 
Wagner teaches above, the removal of unwanted cookies without modifying the browser code, 
and Langford teaches protecting data deleted by a user (c.l,L.66-c.2,L.67). 

Regarding independent claim 14, Quinlan discloses creating and specifying a new unique 
session id — URL — as a result of a browser request (c.6, L.27-67). 

Moreover, Quinlan discloses detecting cookies in the header of the response web page 
(c.7, L.27-67). Quinlan fails to explicitly teach removing information from a document and 
storing that information in a repository on a proxy server. However, Wagner discloses the 
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deletion of cookies from web page headers (c.3,L. 1-67). Langford teaches the deletion of 
desired data, encrypting and then storing it at a remote repository or storage location (c.2,L.34- 
c.3,L.67). It would have been obvious to a person of ordinary skill in the art at the time of the 
invention to have stripped the cookies, and stored them in a repository, because Wagner teaches 
above, the removal of unwanted cookies without modifying the browser code, and Langford 
teaches the deletion and storage of data without user invocation (c.l,L.66-c.2 5 L.67). 

Furthermore, Quinlan discloses detecting cookies in the header of the response web page 
(c.7, L.27-67). Quinlan fails to explicitly teach appending an identifier to any link in the 
document and sending that document to the client. However, Wagner discloses the deletion of 
cookies from web page headers, and sending the modified web page to a user (c.2,L.54- 
c.3,L.67). McGee discloses the appending of a user's login name to all the URLs embedded in a 
web pages (c.lO,L.34-67, c.l l,L.56-67). It would have been obvious to a person of ordinary 
skill in the art at the time of the invention to have stripped the cookies, and appended sent the 
web page to the requesting user, because Wagner teaches above, the removal of unwanted 
cookies without modifying the browser code, and McGee discloses assure that only authorized 
users can access web pages (c.4,L.43-67). 

18. Claims 10-1 1 are rejected under 35 U.S.C. 103(a) as being unpatentable over Quinlan et 
al, hereinafter Quinlan, in view of Wagner, further in view of Langford, further in view of 
McGee, and further in view of Olden (Pat. # 6,460,141 Bl, 10/1/02, filed on 10/28/98). 

Regarding claim 10, which depends on claim 2, Quinlan discloses managing cookies by 
avoiding unnecessary detection of cookies, stored in web page headers and by coding session 
information into URL(s) (c.7,L.26-44). Quinlan fails to explicitly teach setting a lifetime for the 
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unique session id. However, Olden teaches the setting of a maximum lifetime for a cookie 
containing a session id or user id (c.24,L.29-67). It would have been obvious to a person of 
ordinary skill in the art at the time of the invention to have combined the teachings of Quinlan, 
Wagner, Langford, McGee and Olsen, because Olsen teaches above protecting a user from 
malicious attacks. 

Regarding claim 11, which depends on claim 2, Quinlan discloses managing cookies by 
avoiding unnecessary detection of cookies, stored in web page headers and by coding session 
information into URL(s) (c.7,L.26-44). Quinlan fails to explicitly teach dropping the information 
from the cookie repository when the lifetime expires. However, Olden teaches the dropping of the 
use of a cookie once its lifetime expires (c.24,L.29-67). It would have been obvious to a person 
of ordinary skill in the art at the time of the invention to have combined the teachings of Quinlan, 
Wagner, Langford, McGee and Olsen, because Olsen teaches above protecting a user from 
malicious attacks. 

Response to Arguments 

19. Applicant's arguments filed 12/3/02 have been fully considered but they are not 
persuasive. 

In response to applicant's argument that the references fail to show certain features of 
applicant's invention, it is noted that the features upon which applicant relies (i.e., "Nowhere 
does Quinlan disclose the management of cookies 55 P.7,L.10-12) are not recited in the rejected 
claim(s). Although the claims are interpreted in light of the specification, limitations from the 
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specification are not read into the claims. SeeTw re Van Geuns, 988 F.2d 1181, 26 
USPQ2d 1057 (Fed. Cir. 1993). 

The Applicants submit that McGee does not teach the appending a session id to all the 
URLs embedded in a Web page (p.8,L.5-10). The Examiner disagrees, because McGee discloses 
the appending of a user's login name to all the URLs embedded in a web pages (c.l0 5 L.34-67, 
c.ll,L.56-67). 

20. Applicant's arguments with respect to claims 1-14 have been considered but are moot in 
view of the new ground(s) of rejection. 

The Applicants submit that Wagner does not teach the newly added limitation of storing 
deleted cookies in a repository (p.7,L.21-24). The Applicants are directed towards the rejection 
of this limitation above at least in view of the newly found prior art. 

Conclusion 

21. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE -MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
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CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

I. Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Cesar B. Paula whose telephone number is (703) 306-5543. The examiner 
can normally be reached on Monday through Friday from 8:00 a.m. to 4:00 p.m. (EST). 
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Heather Herndon, can be reached on (703) 308-5186. However, in such a case, please allow at 
least one business day. 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the Group receptionist whose telephone number is (703) 305-3900. 
Any response to this Action should be mailed to: 

Director United States Patent and Trademark Office 

Washington, D.C. 20231 
Or faxed to: 

• (703) 746-7238, (for After Final communications intended for entry) 

• (703) 746-7239, (for Formal communications intended for entry, except formal After Final 
communications) 

Or: 

• (703) 746-7240, (for Informal or Draft communications for discussion only, please label 
"PROPOSED" or "DRAFT" ). 

Hand-delivered responses should be brought to Crystal Park II, 2121 Crystal Drive, 
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Arlington, VA, Sixth Floor (Receptionis 

mm 



